For Approval: Common Public Attribution License (CPAL)

[Ross Mayfield]

On 6/26/07, Matthew Flaschen <matthew.flaschen at gatech.edu> wrote:
...

> OSD #10 says, "No provision of the license may be predicated on any
> individual technology or style of interface."  It obviously does not
> explicitly mention this kind of attribution, but that hardly means it's
> irrelevant.
>
> > As Larry Rosen, the General
> > Counsel of the OSI at the time, noted in a January email about OSD 10
> > on this issue:
> >
> > "That isn't historically correct.
> >
> > OSD #10 was written in response to something entirely different. There were
> > attempts at that time to propose licenses that mandated "click-wrap" and
> > similar "I accept the license" interfaces in distributed open source
> > software.
>
> It was written in response to click-wrap.  However, it was not written
> to be specific to click-wrap.  Rather, it determined what the problem
> was (click-wrap clauses limited flexibility in technology and
> interface), and decided such constraints were generally unacceptable.

This is not really correct: OSD 10 was focused on a particular
problem. You can't arbitrarily apply it to a very different issue.
Clickwraps require technology which may not be available. We have
carefully limited our requirements. For example, you expressed
particular concern about the "graphics" requirement (which is part of
the APL): yet we have limited the requirement to "graphic user
interfaces" which by their nature can accommodate graphics.

...

> I didn't mention GPLv3 mainly because it isn't OSI-approved, though I
> hope it will be.  GPLv3 7.b. allows restrictions "requiring preservation
> of specified reasonable legal notices or author attributions in that
> material or in the Appropriate Legal Notices displayed by works
> containing it"
> > The attribution information is only limited to "reasonable" author
> attribution and they do not exclude graphics.
>
> Reasonable's the key word, isn't it...  It means "unreasonable" author
> attribution requirements can be removed (because "All other
> non-permissive additional terms are considered "further restrictions"
> within the meaning of section 10. If the Program as you received it, or
> any part of it, purports to be governed by this License, supplemented by
> a term that is a further restriction, you may remove that term.").
>
> Whether a required graphic is reasonable under GPLv3 is debatable, but I
> think not given how interface-neutral the "Appropriate Legal Notices"
> requirement is.  Several people, including me, have also commented that
> 7.b may be too broad.  In three days, the final license will come out,
> and we will see whether this wording survives.

This response is inconsistent with your earlier complaints about the
APL. The GPLv3 is probably the most intensively reviewed license ever
developed (certainly in open source) and the drafters
decided that attribution should be included. Many other open source
licenses might have included attribution if they had considered it.
And your comment about the Appropriate Legal Notices being "interface
neutral" is wrong. If the drafters of GPLv3 wanted to make it
interface neutral they could have done so. They did not even mention
the issue.

> >> This definition is subjective (doesn't "sufficient duration" depend on
> >> vision, age, attention, etc.) and at the least, could eventually result
> >> in a profusion of attribution, slowing the splash screen into a
> >> slideshow.
> >> This is an OSD #3 problem, since it constrains practical modification.
> >
> > The issue that you raised is whether "prominent" was too vague. We
> > were pointing that "prominent" is widely used in other OSI approved
> > licenses and has not been a problem. We agree that the notice
> > requirements are different.
>
> It's true that "prominent" hasn't been an issue in these other licenses.
>  However, I think the term is much more important in yours.  This is
> because it refers to runtime attribution, and because CAPL's definition
> of prominent would require that multiple attributions have be equal
> prominence (which does not have a precedent).

Many websites have multiple attribution (my favorite example:
http://www.flickr.com/photos/ross/641736794/ ) and it has not caused a
problem. First, your example is hypothetical: it assumes that multiple
entities will decide to use CPAL and demand attribution. We are
skeptical that this situation will arise. If it does arise, we believe
that the licensors will be practical enough to work it out. Moreover,
the "prominent" requirement is flexible and can accommodate different
screens sizes and different numbers of attributions.

...

> > Your premise is incorrect. The OSD is not limited to guaranteeing
> > rights to users
>
> I think it is, when you understand that companies and developers
> redistributing and modifying software are also users.  It was never
> designed to serve the needs of the initial developer (except when they
> later become a user of modified versions of their software).

This statement is simply incorrect. The purpose of OSI which is
clearly stated on the website: the goal is not expressed in terms of
protecting the rights of different constituencies because everyone is
a user of some type. And OSI has not been operating solely focused on
"users": the focus on decreasing the number of approved licenses and
establishing categories of licenses are directly aimed at developers.

> > I appreciate your view of the market, but I would like to understand
> > the factual basis for it.
>
> My observation of MediaWiki, Firefox, and other programs.  Firefox
> actually demands you remove branding if you make any changes.
> Nonetheless, most users of IceWeasel and BurningDog know it's based on
> Firefox.

I still don't understand your reply. The issue is what the user base
in general will know not your personal knowledge. You have not
provided any factual basis for this assertion.

>  I am running a software company and my
> > experience is that, without attribution,  "everyone" will not know who
> > made our software.
>
> I said everyone would know who made SocialText Wiki, and that most
> people would know that forks were based of SocialText (but consider
> whether forks will be significant if you use a license like "Open
> Software License" that requires providing source code for network
> communication)

I don't understand: why would "everyone" know this fact? We have a
great deal of experience with our product in the marketplace and it is
contrary to this statement.

> > OSI is effective because its decisions are based on
> > the realities of the industry.
>
> Maybe, but the OSD is certainly not based on "the realities of the
> industry".  It is based on the Debian Free Software Guidelines; DFSG
> dates back to before there was a substantial open source industry, when
> it was drafted to specify essential user freedoms.

The OSI has clearly stated its purpose on its site which is not
consistent with your statement.

...

The Larger Work provision is parallel to the provision on notices in
the MPL as well as numerous other licenses, so I don't understand the
basis for your statement. OSD 3 provides:

_The license must allow modifications and derived works, and must
allow them to be distributed under the same terms as the license of
the original software._

CPAL permits modifications and derived works. It permits them to be
distributed under the same terms. You mentioned in your last email
that the "splash screen" could be "slowed" to a slide show which would
be a violation of OSD 3. First,  I don't understand how this effects
OSD 3. Second, you can have more than one attribution on a splash
screen, so I think that your hypothetical is not likely. Finally, the
splash screen is merely one among a number of options for attribution.

Ross Mayfield